The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface as it is designed to process untrusted external data, including pull request descriptions, linked issues, and code diffs.
Ingestion points: Phase 0 in SKILL.md identifies that PR metadata (via gh) and diffs (via git) are the primary inputs for review.
Boundary markers: The skill contains robust mitigation instructions in SKILL.md and individual persona briefs (e.g., security-tenancy-reviewer.md), explicitly directing the agent to treat instructions in reviewed content as untrusted and to report attempts to force approval as P0 defects.
Capability inventory: The skill uses Bash for shell execution and the Agent tool to orchestrate multiple sub-processes, providing a path for successful injections to reach execution environments.
Sanitization: While it uses structured data from the gh CLI, it lacks explicit escaping for all variables interpolated into shell commands, though the usage patterns for git and gh are largely restricted.
[COMMAND_EXECUTION]: The skill relies extensively on the Bash tool to perform repository operations and execute verification pipelines.
Evidence: SKILL.md contains multiple shell execution blocks for git diff, gh pr view, and directory management. It also instructs the agent to execute commands found in external files.
[DYNAMIC_EXECUTION]: The skill implements a dynamic discovery mechanism to execute commands defined in a local file if a dependent skill is missing.
Evidence: Phase 2 in SKILL.md directs the agent to read verify-changes/references/command-discovery.md and follow the commands defined therein directly, which represents a runtime dependency on external configuration content.

review-gate